Read the docs
TI-2024-35317 Aliases CVE-2024-52804GHSA-8w49-h785-mj3c

Tornado has HTTP cookie parsing DoS vulnerability

Priority MEDIUM 41CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01044 64th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.4.2tornado (PyPI): 6.4.2Red Hat: 11 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tornadowebtornadobefore 6.4.26.4.2Patch availableCNA
—tornado (PyPI)before 6.4.26.4.2Patch availableGHSA-8w49-h785-mj3c
  • tornado Vendortornadoweb Affected before 6.4.2 Fixed in 6.4.2 Patch available CNA
  • tornado (PyPI) Vendor— Affected before 6.4.2 Fixed in 6.4.2 Patch available GHSA-8w49-h785-mj3c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*before 6.4.2Vulnerabletornadoweb
  • cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions before 6.4.2 Vulnerable ·tornadoweb

Remediation

  • Fix · CNA tornado (tornadoweb) Fixed in 6.4.2
  • Fix · GHSA-8w49-h785-mj3c tornado (PyPI) Fixed in 6.4.2 Advisory →

Red Hat 11 advisories

  • RHSA-2025:3108 Released 2025-03-24 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.2) pcs-0.11.4-7.el9_2.4, pcs-snmp-0.11.4-7.el9_2.4
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) pcs-0.11.4-7.el9_2.4, pcs-snmp-0.11.4-7.el9_2.4
  • RHSA-2025:3109 Released 2025-03-24 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.8.8) pcs-0.10.15-4.el8_8.4, pcs-snmp-0.10.15-4.el8_8.4
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) pcs-0.10.15-4.el8_8.4, pcs-snmp-0.10.15-4.el8_8.4
  • RHSA-2025:2956 Released 2025-03-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.7, pcs-snmp-0.10.12-6.el8_6.7
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.7, pcs-snmp-0.10.12-6.el8_6.7
Show 8 more Red Hat advisories
  • RHSA-2025:2955 Released 2025-03-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.6, pcs-snmp-0.10.8-1.el8_4.6
    • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) pcs-0.10.8-1.el8_4.6, pcs-snmp-0.10.8-1.el8_4.6
    • Red Hat Enterprise Linux HighAvailability TUS (v.8.4) pcs-0.10.8-1.el8_4.6, pcs-snmp-0.10.8-1.el8_4.6
  • RHSA-2025:2872 Released 2025-03-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.4, pcs-snmp-0.10.18-2.el8_10.4
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.4, pcs-snmp-0.10.18-2.el8_10.4
  • RHSA-2025:2550 Released 2025-03-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.7, pcs-snmp-0.11.1-10.el9_0.7
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.7, pcs-snmp-0.11.1-10.el9_0.7
  • RHSA-2025:2470 Released 2025-03-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs-0.11.7-2.el9_4.3, pcs-snmp-0.11.7-2.el9_4.3
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs-0.11.7-2.el9_4.3, pcs-snmp-0.11.7-2.el9_4.3
  • RHSA-2025:2471 Released 2025-03-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.8-1.el9_5.2, pcs-snmp-0.11.8-1.el9_5.2
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.8-1.el9_5.2, pcs-snmp-0.11.8-1.el9_5.2
  • RHSA-2024:10843 Released 2024-12-05 · Red Hat rating Important
    python-tornado security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-tornado-6.4.2-1.el9_4, python3-tornado-6.4.2-1.el9_4
  • RHSA-2024:10836 Released 2024-12-05 · Red Hat rating Important
    python-tornado security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) python-tornado-6.4.2-1.el9_2, python3-tornado-6.4.2-1.el9_2
  • RHSA-2024:10590 Released 2024-12-02 · Red Hat rating Important
    python-tornado security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.4.2-1.el9_5, python3-tornado-6.4.2-1.el9_5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:10590
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:10836
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:10843
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2025:2471
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2025:2955
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2025:2956
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2025:2550
Red Hat Enterprise Linux High Availability EUS (v.8.8)Fixed RHSA-2025:3109
Red Hat Enterprise Linux High Availability EUS (v.9.2)Fixed RHSA-2025:3108
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2025:2470
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2025:2956
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2025:2872
Red Hat Enterprise Linux HighAvailability E4S (v.8.4)Fixed RHSA-2025:2955
Red Hat Enterprise Linux HighAvailability TUS (v.8.4)Fixed RHSA-2025:2955
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2025:2471
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)Fixed RHSA-2025:3109
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)Fixed RHSA-2025:3108
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2025:2470
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2025:2872
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2025:2550
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52804
  2. 2026-10-03 Alias added: GHSA-8w49-h785-mj3c

References

Patch 1

Advisory 2

Other 3

  • TI-2026-24502 Tornado has a DoS due to too many multipart parts CVSS 4.0HIGH 8.7
  • TI-2025-41422 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVSS 3.1HIGH 7.5
  • TI-2025-41421 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVSS 3.1HIGH 7.5
  • TI-2025-29817 Tornado vulnerable to excessive logging caused by malformed multipart form data CVSS 3.1HIGH 7.5
  • TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
  • TI-2014-07904 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be… CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences